OAUTHLINT: An Empirical Study on OAuth Bugs in Android Applications
OAUTHLINT: An Empirical Study on OAuth Bugs in Android Applications
复制标题
DOI：
10.1109/ase.2019.00036
复制
发表时间：
2019-11
期刊：
影响因子：
--
通讯作者：
Tamjid Al Rahat;Yu Feng;Yuan Tian
中科院分区：
文献类型：
--
作者：
Tamjid Al Rahat;Yu Feng;Yuan Tian
移动的开发人员使用OAuth API来实现单点登录服务。然而，OAuth协议最初是为第三方网站的授权而设计的，而不是对第三方移动的应用程序中的用户进行身份验证。因此，开发人员正确安全地实现移动的OAuth是一个挑战。由于对OAuth的误解和开发人员的经验不足，这些漏洞可能导致数据泄露和帐户泄露。在本文中，我们对OAuth API在Android应用程序中的使用及其安全影响进行了实证研究。特别是，我们开发了OASON LINT，它结合了查询驱动的静态分析，可以自动检查Google Play市场上的程序。OASHLINT将一个反协议作为输入，该反协议对从OAuth规范和程序P中提取的易受攻击的模式进行编码。如果反协议可以匹配Ps可能执行的痕迹，则我们的工具将生成一个反例。为了评估我们方法的有效性，我们对600多个下载量超过1000万的流行应用程序进行了系统研究。在316个使用OAuth API的应用程序中，有101个（32%）至少犯了一个安全错误。
Mobile developers use OAuth APIs to implement Single-Sign-On services. However, the OAuth protocol was originally designed for the authorization for third-party websites not to authenticate users in third-party mobile apps. As a result, it is challenging for developers to correctly implement mobile OAuth securely. These vulnerabilities due to the misunderstanding of OAuth and inexperience of developers could lead to data leakage and account breach. In this paper, we perform an empirical study on the usage of OAuth APIs in Android applications and their security implications. In particular, we develop OAUTHLINT, that incorporates a query-driven static analysis to automatically check programs on the Google Play marketplace. OAUTHLINT takes as input an anti-protocol that encodes a vulnerable pattern extracted from the OAuth specifications and a program P. Our tool then generates a counter-example if the anti-protocol can match a trace of Ps possible executions. To evaluate the effectiveness of our approach, we perform a systematic study on 600+ popular apps which have more than 10 millions of downloads. The evaluation shows that 101 (32%) out of 316 applications that use OAuth APIs make at least one security mistake.